GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos

Noma Labs just showed why letting an AI agent read your GitHub issues can be a very bad idea. The researchers found a flaw in GitHub's new Agentic Workflows — the feature that pairs GitHub Actions with an AI agent powered by Claude or Copilot, letting teams write automation in plain Markdown instead of YAML. They named the bug GitLost, and the mechanics behind it are almost embarrassingly simple.

Here's the trick. The vulnerable workflow was set up to trigger whenever an issue got assigned, read the issue's title and body, then post a reply using an add-comment tool. Crucially, the agent also had read access to other repos in the organization, public and private alike. Noma's researchers opened a public issue that looked like an ordinary message from a VP of Sales describing a customer meeting. Nothing about it screamed malicious. But buried in that innocent-looking text were instructions the agent would follow as if they came from its own operator. Once the issue got assigned, the agent fetched README.md files from a public repo and a private one called testlocal, then posted both openly as a comment anyone could read.

GitHub did have guardrails meant to stop exactly this kind of leak. They didn't hold up. Noma found that simply adding the word "Additionally" to the injected prompt was enough to get the model to reframe its response instead of refusing it outright, quietly slipping the private data through anyway. No credentials, no special access, no coding skill required — just patience and a well-worded issue in a public repo belonging to the same organization.

What makes this worth paying attention to isn't the specific exploit, which GitHub has since been told about through responsible disclosure. It's the pattern underneath it. Noma frames prompt injection as agentic AI's version of SQL injection: a whole category of vulnerability rather than a one-off bug, because these systems treat the content they read as instructions they should follow. An agent's context window, in other words, doubles as its attack surface. Anything it reads — issues, comments, pull requests, files — becomes a potential vector, and traditional code-enforced trust boundaries don't fully apply when the enforcement depends on how an instruction-following model behaves.

Noma's advice for teams building these systems is blunt: never treat user-submitted content as trusted instructions, keep agent permissions as narrow as possible, limit what agents can post publicly, and separate user input from the instruction context before it ever reaches the model.